Privacy

The short version

We cannot read your messages. They are encrypted on your phone before they reach us, and we do not hold the key. We do not ask for your phone number or your contacts. We do not show ads, and we do not sell anything about you to anyone.

We do store some things, because a messaging service cannot work otherwise. That list is below, and it is the whole list. Profile pictures are different from message media — see below.

Who we are

Tern is operated by Nomli Tech Limited (the data controller). For anything in this policy, including our registered office address, write to support-tern@niilox.com.

What we store

• Your Tern ID. The eight-character public identifier you share with people. Kept while you keep using Tern.
• Your device token. A random secret your app holds to prove it is you. We store only a hash of it, never the token itself.
• A push notification token from Apple or Google, so your phone can be woken when a message arrives. Kept while you keep using Tern or until you turn wake-ups off.
• Messages we have not yet delivered, as encrypted bytes we cannot read, plus the sender’s and recipient’s ids and a timestamp so we know where to send them. Deleted the moment they are delivered, and discarded after 30 days if they never are.
• Message media. Photos, voice notes and documents you send in a chat are encrypted on your phone with a key only you and the recipient hold. We store the ciphertext until delivery (or up to 30 days), and we cannot read it.
• Profile pictures. If you set one, it is encrypted at rest, but the key is published with your public directory entry so chat partners can show your picture without a prior message. That means we (and anyone who can read that directory entry) can decrypt the image. Deleted after a year of inactivity, or when you clear or uninstall the app and we later remove unused directory data.
• Your public encryption keys (identity and optional signing key, and an optional avatar descriptor), so other people can message you securely and show your profile picture. Kept while you keep using Tern.
• Connection records, including your IP address, kept for 14 days to detect abuse and keep the service running.
• Anything you report to us. When you report a person or conversation, your app may send us the reported content and nearby messages in readable form, because you chose to show them to us. Kept for 12 months, or longer if needed for an ongoing safety or legal matter.

What we never have

• The contents of your messages, voice notes, or photos and documents sent in a chat, unless you report them to us. (Profile pictures are different — see above.)
• Your phone number. Tern does not use one.
• Your contacts or address book. The app does not request permission to read them, and your nicknames for people never leave your phone.
• Your location. We do not collect it, and photos are re-encoded before sending, which removes location metadata a camera may store in them.
• Any analytics or advertising code. There is none in the app.

What stays on your phone

Your chat history, your nicknames for people, payment details you save, and any media you have downloaded live only on your device. We hold no copy. If you lose your phone, that history is gone — and if you move to a new phone, your Tern ID can come back but your old conversations do not.

Push notifications

To wake your phone we send a signal through Apple or Google. It carries no message content — those companies learn that something arrived for your device, not what it was or who sent it.

Where your data is

Our messaging and identity servers run in the European Union. Encrypted file storage used by the app is also in the European Union. If you live outside the EU, your data is processed in the EU when you use Tern.

Your rights

Depending on where you live, you may ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to send it somewhere else, or object to how we use it. Write to support-tern@niilox.com and we will respond within 30 days.

You can also complain to a data protection authority. In the European Union you may contact your local supervisory authority.

Leaving Tern

Tern does not use a traditional account. Your chats, keys and nicknames live on your phone. To leave, clear the app’s data or uninstall it — that removes what Tern stored on the device.

To ask us to delete what we still hold on our servers about your Tern ID, follow Delete your account. Undelivered messages expire on the schedule above. Messages you already sent to other people stay on their phones. Reports and connection records are kept for the periods above.

Children

Tern is not for anyone under 16. If you are under 18, check your local law and get a parent’s permission before using it. If we learn that someone under 16 is using Tern, we remove what we hold for that Tern ID.

Security

Messages and chat media are end-to-end encrypted with keys only you and the recipient hold. Profile pictures are encrypted at rest but decryptable from the public directory entry, so partners can see them. Connections to our servers are encrypted in transit. No system is perfect, and we will tell you if something happens that affects you.

Changes

If we change this policy we will update the date at the top and tell you in the app before the change takes effect.

Contact

Nomli Tech Limited
Email: support-tern@niilox.com
Registered office address: available on request at that email.